Vulnerability scanning

Subscription

Pay-as-you-go

Manual scan

1. Log on to the Security Center console.

2. On the Vulnerabilities page, click Quick Scan (All Servers). In the Vulnerability Scan dialog box, select the vulnerability types to scan, and then click OK.

   Note

   To scan specific servers instead of all servers, go to the Host page, select the target servers, click Security Check at the bottom of the page, and then select Vulnerabilities in the dialog box.

Automatic (periodic) scan

Automatic scanning uses two scheduling approaches depending on the vulnerability type:

• Default cycle (not configurable):

  • Applies to Linux Software Vulnerability and Windows System Vulnerability.

  • Default scan frequency:

    • Subscription:

      • Advanced, Enterprise, Ultimate — once per day;

      • Basic, Value-added Plan, Anti-virus — once every two days.

    • Pay-as-you-go:

      • Host Protection, Hosts and Container Protection — once per day;

      • Unprotected, Antivirus — once every two days.

• User-defined cycle:

  • Applies to Application Vulnerability and Urgent Vulnerability.

  • Available for Subscription (Advanced,Enterprise,Ultimate) and Pay-as-you-go (Host Protection,Hosts and Container Protection).

To configure automatic scanning:

1. Log on to the Security Center console.

2. In the Vulnerabilities page, click Vulnerability Settings. Configure the following settings as needed:

   Parameter	Description
   Vulnerability scan switch	Enables or disables scanning for various vulnerability types (Linux Software Vulnerability, Windows System Vulnerability, Web-CMS Vulnerability, Application Vulnerability, and Urgent Vulnerability). After you enable a scan, you can click Manage to specify the servers to which the scan applies.
   YUM/APT Source Configuration	When enabled, Alibaba Cloud official YUM/APT sources take priority for fixing Linux vulnerabilities, which significantly improves the remediation success rate.
   Urgent Vulnerability Scan Cycle	Sets the execution frequency for urgent vulnerability scan tasks. Default scan window: Chinese Mainland: 00:00:00 (UTC+8) to 07:00:00 (UTC+8). Outside Chinese Mainland: 00:00:00 (UTC+7) to 07:00:00 (UTC+7). Available editions/protection levels: Subscription: Advanced, Enterprise, and Ultimate. Pay-as-you-go: Host Protection and Hosts and Container Protection.
   Application Vulnerability Scan Cycle	Sets the execution frequency for application vulnerability scan tasks. Default scan window: Chinese Mainland: 00:00:00 (UTC+8) to 07:00:00 (UTC+8). Outside Chinese Mainland: A staggered scheduling mechanism runs scans at different times within a 24-hour period. Available editions/protection levels: Subscription: Enterprise and Ultimate. Pay-as-you-go: Host Protection and Hosts and Container Protection.
   System Vulnerabilities Scanned At	Sets a specific time for Linux Software Vulnerability and Windows System Vulnerability scan tasks to run.
   Retain Invalid Vulnerabilities For	Sets the data cleanup period for stale vulnerabilities. The system considers vulnerabilities that are not re-detected or handled for an extended period to be stale. Stale vulnerabilities are automatically archived to the "Handled" list. After the period you configured in Retain Invalid Vulnerabilities For expires, the system permanently deletes them to reduce clutter. Note If Security Center detects the same type of vulnerability again in the future, a new alert is generated.
   Vulnerability Scan Level	Sets the risk levels of vulnerabilities to scan for. The system scans for and reports only the vulnerabilities that match the selected levels.
   Vulnerability Whitelist Settings	Add vulnerabilities that you decide not to fix (for example, due to business requirements or acceptable risk) to a whitelist. These vulnerabilities are then ignored in future scans. Note After you add a vulnerability whitelist rule, you can manage it (edit or delete) on the Vulnerability Whitelist Settings tab in the Vulnerability Settings panel.

Troubleshoot stalled scan progress

If a scan task remains at 0% progress or stays in the "Scanning" status for an extended period, follow these steps:

1. Check agent status: Verify that the Security Center agent on the target server is online. If the agent status is abnormal, try refreshing the page or restarting the agent service on the server.

2. Locate failed servers: Click Task Management in the upper-right corner of the vulnerability management page to view task details and identify servers where scanning failed.

3. Run emergency scan for failed servers: Click Vulnerability Settings in the upper-right corner, find the Urgent Vulnerability Scan Cycle option, select only the failed servers, and run a one-click scan to complete the remaining vulnerability detection.

4. Report shows 0 vulnerabilities: If the scan completes but the report shows 0 vulnerabilities, manually run a vulnerability scan and virus scan first, then view or export the report again after scanning completes.

Troubleshoot Linux vulnerabilities not displayed

If Linux-related vulnerabilities (such as specific CVE kernel privilege escalation vulnerabilities) are not displayed in the console, follow these steps:

1. Check filter settings: On the vulnerability management page, check whether any filter switches or view settings are enabled (such as filtering by specific risk levels). Disable relevant filters or adjust view settings to ensure Linux vulnerabilities are displayed.

2. Re-run the scan: If vulnerabilities are still not displayed after adjusting filters, click Quick Scan to re-run the vulnerability scan. Also, log on to the server and run the following command to confirm the system kernel version:

   uname -r

3. Assess CVE vulnerability impact: For specific CVE vulnerabilities (such as CVE-2026-31431), check whether the kernel version falls within the affected range (such as kernel versions between 4.14 and 7.0). If confirmed as affected, refer to the official security advisory for temporary mitigations and upgrade after the official patch is released.

Windows high-risk vulnerability fix notes

When fixing high-risk Windows vulnerabilities (such as CVE-2026-26170 and other vulnerabilities involving OS-level components), note the following:

1. Back up before fixing: Create an ECS instance snapshot before applying the fix so you can quickly roll back if issues occur.

2. Fix during off-peak hours: Such fixes may require a server restart. Perform the fix during off-peak business hours to minimize impact.

3. Restart after fixing: Windows system patches typically require a server restart to take effect. Restart the server promptly after the fix is applied.

Scan behavior and results

• Why are multiple instances of the same vulnerability reported for a single server?

  Application vulnerability detection targets specific running process instances. If a server runs multiple instances of a process with the same vulnerability, such as two identical Tomcat services on different ports, the system reports a separate vulnerability for each instance. If the vulnerable software is installed but its corresponding process is not running, the vulnerability is not detected.

• Why do scan results for vulnerabilities like Fastjson sometimes vary?

  The detection of such vulnerabilities depends on whether their components, such as JAR packages, are loaded into a "runtime" state during the scan. In a dynamic loading model, the system identifies the vulnerability only when business logic calls the vulnerable component. Therefore, scan results may differ at different times.

  Note

  To improve detection accuracy for these types of vulnerabilities, we recommend that you run periodic or multiple scans.

• Why do vulnerability records for a host remain on the console after its agent goes offline?

  When an agent goes offline, its previously detected vulnerability records are retained on the console. However, these records automatically become stale, and you cannot act on them (for example, remediate, verify, or delete them). Vulnerabilities automatically become stale after the following periods:

  Important

  All data is permanently deleted only if the Security Center service expires and is not renewed within 7 days.

  • Linux Software Vulnerability and Windows System Vulnerability: 3 days.

  • Web-CMS Vulnerability: 7 days.

  • Application Vulnerability: 30 days.

  • Urgent Vulnerability: 90 days.

• Will a manual scan affect the automatic scanning schedule?

  Running a manual one-click scan does not affect the existing automatic scan schedule. The two operate independently. Automatic scans, such as system vulnerability scans that run daily or every two days, continue on their scheduled cycles regardless of manual scans.

Performance impact and security

• Do vulnerability scans or POCs for urgent vulnerabilities affect business systems?

  Typically, no. The POCs from Security Center send only one or two harmless probe requests and do not perform any attacks or destructive actions. However, in rare cases where an application handles unexpected input poorly, a minimal, unknown risk might exist.

• Why can a vulnerability scan trigger an out-of-memory (OOM) error?

  The Security Center agent has a default memory limit of 200 MB. If memory usage during a scan exceeds this limit, the system's OOM mechanism terminates the detection process (ALiSecCheck) to conserve resources.

  Note

  • This limit is typically managed by a control group (cgroup) named aegisRtap0. You can find related OOM information in the dmesg logs.

  • This is normal behavior and does not indicate a system-wide memory shortage. No user intervention is required.

  • This type of Out of Memory (OOM) error results from a cgroup memory limit, not a system-wide memory shortage.

Scan scope and capabilities

1. What does the vulnerability scan cover?

   Scanning covers both the system and application layers:

   • System layer: Linux Software Vulnerability and Windows System Vulnerability.

     Important

     Windows System Vulnerability scanning supports only monthly security update patches.

   • Application layer: Web-CMS Vulnerability, Application Vulnerability, and Urgent Vulnerability.

2. How do I view the list of vulnerabilities that Security Center can detect?

   1. Log on to the Security Center console.

   2. In the left-side navigation pane, choose Vulnerabilities > Vulnerabilities. In the overview section, find the Disclosed Vulnerabilities card.

   3. Click the total number of vulnerabilities on the card to view a list of all detectable vulnerabilities and their details.

3. Is detection for specific vulnerabilities like Elasticsearch supported?

   Yes. You can view detection results for services like Elasticsearch on the Application Vulnerability page in the console.

   Note

   This feature is available only for Subscription (Enterprise and Ultimate editions) and Pay-as-you-go (Host Protection and Hosts and Container Protection). If your current edition does not support this feature, upgrade your service.